[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.LFD.2.10.1402101533280.3480@wniryva.cad.erqung.pbz>
Date: Mon, 10 Feb 2014 17:47:14 +0530 (IST)
From: P J P <ppandit@...hat.com>
To: oss security list <oss-security@...ts.openwall.com>
Subject: Re: CVE Request New-djbdns: dnscache: potential cache
poisoning
+-- On Mon, 10 Feb 2014, Florian Weimer wrote --+
| How it is possible to poison the cache if the response is not cached?
IIUC, response is cached, and cached in the same location. Because it
'hashes' to the same bucket always, an attacker is able to overwrite entries
in that bucket by flooding a resolver with queries involving other domains
whose resource records also 'hash' to the same bucket.
As 'dnscache' does not go beyond 100 entries in this bucket, it is made to
contact TLD servers for new requests. If this query pattern of 'dnscache' is
predictable, it could be possible to poison it with usual response flood
technique (of-course that's easier said than done).
With 'SipHash' function, that 'bucket' selection is randomised. IOW, multiple
queries with a same domain/key might 'hash' to different buckets.
That's my understanding of the post. I'll check with the upstream author for
more clarification.
Thank you.
--
Prasad J Pandit / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
